diff options
| author |   Eric W. Biederman <ebiederm@xmission.com> | 2012-11-16 03:02:59 +0000 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2012-11-18 20:30:55 -0500 |
| commit | 464dc801c76aa0db88e16e8f5f47c6879858b9b2 (patch) | |
| tree | cfaf0f43f4ce50669f07031ec42062b4c9a7f985 /net/netfilter/nf_conntrack_ecache.c | |
| parent | sysctl: Pass useful parameters to sysctl permissions (diff) | |
| download | linux-dev-464dc801c76aa0db88e16e8f5f47c6879858b9b2.tar.xz linux-dev-464dc801c76aa0db88e16e8f5f47c6879858b9b2.zip | |
net: Don't export sysctls to unprivileged users
In preparation for supporting the creation of network namespaces
by unprivileged users, modify all of the per net sysctl exports
and refuse to allow them to unprivileged users.
This makes it safe for unprivileged users in general to access
per net sysctls, and allows sysctls to be exported to unprivileged
users on an individual basis as they are deemed safe.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netfilter/nf_conntrack_ecache.c')
| -rw-r--r-- | net/netfilter/nf_conntrack_ecache.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index de9781b6464f..faa978f1714b 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -196,6 +196,10 @@ static int nf_conntrack_event_init_sysctl(struct net *net) table[0].data = &net->ct.sysctl_events; table[1].data = &net->ct.sysctl_events_retry_timeout; + /* Don't export sysctls to unprivileged users */ + if (net->user_ns != &init_user_ns) + table[0].procname = NULL; + net->ct.event_sysctl_header = register_net_sysctl(net, "net/netfilter", table); if (!net->ct.event_sysctl_header) { |